Universal Detection of Backdoor Attacks via Density-based Clustering and Centroids Analysis

• Published in: IEEE transactions on information forensics and security Vol. 19; p. 1
• Main Authors: Guo, Wei, Tondi, Benedetta, Barni, Mauro
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.01.2024; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Artificial neural networks; Backdoor Attack; Centroids; Centroids Analysis; Clustering; Clustering algorithms; Data models; Deep Learning; Density; Density Clustering; Feature extraction; Information filters; Predictive models; Training; Training data; Universal Detection of Backdoor Attacks
• ISSN: 1556-6013; 1556-6021; 1556-6021
• DOI: 10.1109/TIFS.2023.3329426

We propose a Universal Defence against backdoor attacks based on Clustering and Centroids Analysis (CCA-UD). The goal of the defence is to reveal whether a Deep Neural Network model is subject to a backdoor attack by inspecting the training dataset. CCA-UD first clusters the samples of the training set by means of density-based clustering. Then, it applies a novel strategy to detect the presence of poisoned clusters. The proposed strategy is based on a general misclassification behaviour observed when the features of a representative example of the analysed cluster are added to benign samples. The capability of inducing a misclassification error is a general characteristic of poisoned samples, hence the proposed defence is attack-agnostic. This marks a significant difference with respect to existing defences, that, either can defend against only some types of backdoor attacks, or are effective only when some conditions on the poisoning ratio or the kind of triggering signal used by the attacker are satisfied. Experiments carried out on several classification tasks and network architectures, considering different types of backdoor attacks (with either clean or corrupted labels), and triggering signals, including both global and local triggering signals, as well as sample-specific and source-specific triggers, reveal that the proposed method is very effective to defend against backdoor attacks in all the cases, always outperforming the state of the art techniques.